CVE-2015-3197

Published: Feb 15, 2016Modified: May 6, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

Affected (38)

Products: Oracle: Tuxedo, Exalogic Infrastructure, Peoplesoft Enterprise Peopletools, Oss Support Tools, Vm Virtualbox · Openssl: Openssl

Oracle

5 products

Tuxedo

Exalogic Infrastructure

Peoplesoft Enterprise Peopletools

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Tuxedo	Version 12.1.1.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Exalogic Infrastructure	Version 1.0
Oracle Exalogic Infrastructure	Version 2.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Peoplesoft Enterprise Peopletools	Version 8.53
Oracle Peoplesoft Enterprise Peopletools	Version 8.54
Oracle Peoplesoft Enterprise Peopletools	Version 8.55

Configuration D

30 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j
Openssl Openssl	Version 1.0.1k
Openssl Openssl	Version 1.0.1l
Openssl Openssl	Version 1.0.1m
Openssl Openssl	Version 1.0.1n
Openssl Openssl	Version 1.0.1o
Openssl Openssl	Version 1.0.1p
Openssl Openssl	Version 1.0.1q
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2 beta2
Openssl Openssl	Version 1.0.2 beta3
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b
Openssl Openssl	Version 1.0.2c
Openssl Openssl	Version 1.0.2d
Openssl Openssl	Version 1.0.2e

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Oss Support Tools	Version 8.11.16.3.8

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Vm Virtualbox	Version 5.0.16

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-310

References (72)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html

Source: secalert@redhat.com

http://www.openssl.org/news/secadv/20160128.txt

Source: secalert@redhat.com

Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Source: secalert@redhat.com

Patch

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/82237

Source: secalert@redhat.com

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

http://www.securitytracker.com/id/1034849

Source: secalert@redhat.com

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=d81a1600588b726c2bdccda7efad3cc7a87d6245

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893

Source: secalert@redhat.com

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:11.openssl.asc

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201601-05

Source: secalert@redhat.com

https://www.kb.cert.org/vuls/id/257823

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759